{
  "schemaVersion": 1,
  "kind": "csint-n8n-workflow-change-receipt",
  "reviewEngineVersion": "1.3.0",
  "fingerprintAlgorithm": "sha256-canonical-json-v1",
  "generatedAt": "2026-09-30T12:00:00.000Z",
  "reviewId": "wcr-de8a24719838-32597b9b",
  "title": "Değişiklik C: Ajan adım sınırı 10'dan 100'e çıkıyor",
  "reviewer": "Ahmet Göker",
  "decision": "review",
  "decisionReason": "Static evidence is available, but no passing staging receipt is bound to this exact candidate.",
  "decisionBasis": "no-runtime",
  "subject": {
    "baseline": {
      "name": "Scanner Alert Triage",
      "fingerprint": "32597b9b3c204f6443180229532b6ac3a3e9b9edbe4fd3b1121f27676951e08b",
      "nodeCount": 7
    },
    "candidate": {
      "name": "Scanner Alert Triage",
      "fingerprint": "de8a24719838b955a785925d4d6ec782b212eef1b34fb341664ed8f8b86278cd",
      "nodeCount": 7
    }
  },
  "summary": {
    "changes": 1,
    "blocker": 0,
    "review": 1,
    "improvement": 0,
    "context": 0,
    "connectionsAdded": 0,
    "connectionsRemoved": 0,
    "introducedFindings": 0,
    "resolvedFindings": 0,
    "openFindings": 7,
    "preExistingOpenFindings": 7,
    "renamedNodes": 0
  },
  "runtime": {
    "status": "not-run",
    "bound": false,
    "verifiedAt": null,
    "executedWorkflowFingerprint": null,
    "scenarios": {
      "passed": 0,
      "failed": 0,
      "total": 0
    },
    "checks": {
      "passed": 0,
      "total": 0
    },
    "externalActionsExecuted": null,
    "coveredStaticRules": [],
    "note": "No candidate-bound staging receipt was supplied."
  },
  "retest": {
    "status": "not-supplied",
    "priorReviewId": null,
    "priorCandidateFingerprint": null,
    "priorDecision": null,
    "priorFindingRuleIds": [],
    "fixedFindingRuleIds": [],
    "remainingFindingRuleIds": [],
    "introducedFindingRuleIds": [],
    "note": "No prior ReleaseGuard receipt was supplied for retest comparison."
  },
  "manualReviews": [
    {
      "id": "MR-001",
      "appliesTo": "finding",
      "subjectId": "TG-100-01",
      "status": "likely",
      "reviewer": "Ahmet Göker",
      "reviewedAt": "2026-09-30T13:00:00.000Z",
      "note": "Webhook'tan Alert Triage Agent üzerinden Send a message adımına giden yol gerçek: alert JSON'unun tamamı prompta giriyor ve alert alanları saldırganın kontrol ettiği bir metin taşıyabilir, örneğin bir kullanıcı veya kaynak adı. Webhook header doğrulaması kullanıyor ve son adım tek bir sabit Slack kanalına yazıyor; en kötü sonuç yanlış veya yanıltıcı bir triage notu. Bu şablon için kritik değil, orta seviye derim."
    },
    {
      "id": "MR-002",
      "appliesTo": "finding",
      "subjectId": "AA-003-02",
      "status": "confirmed",
      "reviewer": "Ahmet Göker",
      "reviewedAt": "2026-09-30T13:00:00.000Z",
      "note": "Doğrulandı. Prompt, istek öğesinin tamamı JSON.stringify ile yazılarak kuruluyor; öncesinde boyutu sınırlayan veya serbest metni ayıklayan bir adım yok. Bir triage ajanı için bu tasarım gereği; bu yüzden çağırabildiği araçların yalnız okuma yapması önemli."
    },
    {
      "id": "MR-003",
      "appliesTo": "finding",
      "subjectId": "AA-004-03",
      "status": "confirmed",
      "reviewer": "Ahmet Göker",
      "reviewedAt": "2026-09-30T13:00:00.000Z",
      "note": "Doğrulandı ve tasarım gereği: model çıktısı onay adımı olmadan Slack'e gönderiliyor. Triage notunu kanala yazmak workflow'un amacı. Burada onay gerekmiyor, ama başka bir yere yazan her adımdan önce gerekiyor."
    },
    {
      "id": "MR-004",
      "appliesTo": "finding",
      "subjectId": "AA-006-04",
      "status": "needs-environment-evidence",
      "reviewer": "Ahmet Göker",
      "reviewedAt": "2026-09-30T13:00:00.000Z",
      "note": "Exportta görünür bir hız veya maliyet sınırı yok. Alertler header doğrulamasının arkasındaki tespit platformundan geliyor; sınır gönderen tarafta olabilir, export bunu gösteremez. Alert hızının nerede sınırlandığını ekibe sorun."
    },
    {
      "id": "MR-005",
      "appliesTo": "finding",
      "subjectId": "AA-005-05",
      "status": "confirmed",
      "reviewer": "Ahmet Göker",
      "reviewedAt": "2026-09-30T13:00:00.000Z",
      "note": "Doğrulandı. Slack metni, yalnız ilk siren emojisinden itibaren kesilen model çıktısı. Üzerinde şema kontrolü çalışmıyor."
    },
    {
      "id": "MR-006",
      "appliesTo": "finding",
      "subjectId": "AA-008-06",
      "status": "confirmed",
      "reviewer": "Ahmet Göker",
      "reviewedAt": "2026-09-30T13:00:00.000Z",
      "note": "Doğrulandı. HTTP araçlarında zaman aşımı ve yeniden deneme yok; yavaş bir sorgu API'si ajanın tüm çalışmasını bekletir."
    },
    {
      "id": "MR-007",
      "appliesTo": "finding",
      "subjectId": "AA-010-07",
      "status": "confirmed",
      "reviewer": "Ahmet Göker",
      "reviewedAt": "2026-09-30T13:00:00.000Z",
      "note": "Doğrulandı, düşük. Hata workflow'u tanımlı değil; başarısız bir triage çalışması, biri çalışma listesine bakmadıkça fark edilmez."
    }
  ],
  "environmentEvidence": {
    "instanceAudit": null,
    "publishedWorkflowIdentity": {
      "status": "not-verified",
      "note": "The identity of the workflow actually published to production was not independently verified."
    },
    "productionPermissions": {
      "status": "not-verified",
      "note": "Production credential and external-service permissions were not independently verified."
    },
    "productionRegister": []
  },
  "customerAcceptance": {
    "status": "not-recorded",
    "acceptedBy": "Customer acceptance pending",
    "recordedAt": null,
    "note": ""
  },
  "changes": [
    {
      "id": "CR-001",
      "kind": "agent-limit-loosened",
      "impact": "review",
      "title": "An agent limit was loosened: Alert Triage Agent",
      "note": "maxIterations 10 (n8n default) to 100. One input can now drive more model and tool calls before the run stops, which raises cost and the number of actions a manipulated input can trigger. Confirm the new value is intended and that a cost or rate limit still applies.",
      "evidence": {
        "node": "Alert Triage Agent",
        "nodeType": "@n8n/n8n-nodes-langchain.agent",
        "limits": [
          {
            "field": "maxIterations",
            "before": 10,
            "beforeDefault": true,
            "after": 100
          }
        ]
      }
    }
  ],
  "candidateEvidence": {
    "analyzerVersion": "1.1.0",
    "policy": {
      "allowedOutboundDomains": [],
      "blockedNodeTypes": [],
      "blockedCredentialTypes": [],
      "requireHumanApprovalBefore": [],
      "dynamicTargetPolicy": "review"
    },
    "inventory": {
      "triggers": [
        {
          "name": "Webhook",
          "type": "n8n-nodes-base.webhook"
        }
      ],
      "aiAgents": [
        {
          "name": "Alert Triage Agent",
          "type": "@n8n/n8n-nodes-langchain.agent",
          "tools": [
            "OTX IOC Lookup",
            "Scanner MCP",
            "ThreatFox IOC Lookup"
          ],
          "memory": []
        }
      ],
      "modelNodes": [
        {
          "name": "Anthropic Chat Model",
          "type": "@n8n/n8n-nodes-langchain.lmChatAnthropic"
        }
      ],
      "toolNodes": [
        {
          "name": "OTX IOC Lookup",
          "type": "n8n-nodes-base.httpRequestTool",
          "agent": "Alert Triage Agent"
        },
        {
          "name": "Scanner MCP",
          "type": "@n8n/n8n-nodes-langchain.mcpClientTool",
          "agent": "Alert Triage Agent"
        },
        {
          "name": "ThreatFox IOC Lookup",
          "type": "n8n-nodes-base.httpRequestTool",
          "agent": "Alert Triage Agent"
        }
      ],
      "outboundDomains": [
        {
          "domain": "mcp.your-env.scanner.dev",
          "nodes": [
            "Scanner MCP"
          ]
        },
        {
          "domain": "otx.alienvault.com",
          "nodes": [
            "OTX IOC Lookup"
          ]
        },
        {
          "domain": "threatfox-api.abuse.ch",
          "nodes": [
            "ThreatFox IOC Lookup"
          ]
        }
      ],
      "credentialTypes": [
        {
          "type": "anthropicapi",
          "nodes": [
            "Anthropic Chat Model"
          ]
        },
        {
          "type": "httpbearerauth",
          "nodes": [
            "Scanner MCP"
          ]
        },
        {
          "type": "httpheaderauth",
          "nodes": [
            "OTX IOC Lookup",
            "ThreatFox IOC Lookup",
            "Webhook"
          ]
        },
        {
          "type": "slackapi",
          "nodes": [
            "Send a message"
          ]
        }
      ]
    },
    "graph": {
      "nodes": [
        {
          "id": "Anthropic Chat Model",
          "findings": [
            "AA-005-05"
          ],
          "severity": "medium",
          "label": "Anthropic Chat Model",
          "kind": "model",
          "nodeType": "@n8n/n8n-nodes-langchain.lmChatAnthropic"
        },
        {
          "id": "Alert Triage Agent",
          "findings": [
            "AA-003-02",
            "AA-004-03",
            "AA-005-05",
            "TG-100-01"
          ],
          "severity": "critical",
          "label": "Alert Triage Agent",
          "kind": "ai-agent",
          "nodeType": "@n8n/n8n-nodes-langchain.agent"
        },
        {
          "id": "Scanner MCP",
          "findings": [],
          "severity": null,
          "label": "Scanner MCP",
          "kind": "tool",
          "nodeType": "@n8n/n8n-nodes-langchain.mcpClientTool"
        },
        {
          "id": "ThreatFox IOC Lookup",
          "findings": [
            "AA-008-06"
          ],
          "severity": "medium",
          "label": "ThreatFox IOC Lookup",
          "kind": "tool",
          "nodeType": "n8n-nodes-base.httpRequestTool"
        },
        {
          "id": "OTX IOC Lookup",
          "findings": [
            "AA-008-06"
          ],
          "severity": "medium",
          "label": "OTX IOC Lookup",
          "kind": "tool",
          "nodeType": "n8n-nodes-base.httpRequestTool"
        },
        {
          "id": "Send a message",
          "findings": [
            "AA-004-03",
            "TG-100-01"
          ],
          "severity": "critical",
          "label": "Send a message",
          "kind": "high-impact-action",
          "nodeType": "n8n-nodes-base.slack"
        },
        {
          "id": "Webhook",
          "findings": [
            "AA-003-02",
            "AA-006-04",
            "TG-100-01"
          ],
          "severity": "critical",
          "label": "Webhook",
          "kind": "untrusted-input",
          "nodeType": "n8n-nodes-base.webhook"
        },
        {
          "id": "credential:anthropicapi",
          "findings": [],
          "severity": null,
          "label": "anthropicapi",
          "kind": "credential",
          "nodeType": "credential"
        },
        {
          "id": "credential:httpbearerauth",
          "findings": [],
          "severity": null,
          "label": "httpbearerauth",
          "kind": "credential",
          "nodeType": "credential"
        },
        {
          "id": "credential:httpheaderauth",
          "findings": [],
          "severity": null,
          "label": "httpheaderauth",
          "kind": "credential",
          "nodeType": "credential"
        },
        {
          "id": "credential:slackapi",
          "findings": [],
          "severity": null,
          "label": "slackapi",
          "kind": "credential",
          "nodeType": "credential"
        },
        {
          "id": "domain:mcp.your-env.scanner.dev",
          "findings": [],
          "severity": null,
          "label": "mcp.your-env.scanner.dev",
          "kind": "external-domain",
          "nodeType": "domain"
        },
        {
          "id": "domain:otx.alienvault.com",
          "findings": [],
          "severity": null,
          "label": "otx.alienvault.com",
          "kind": "external-domain",
          "nodeType": "domain"
        },
        {
          "id": "domain:threatfox-api.abuse.ch",
          "findings": [],
          "severity": null,
          "label": "threatfox-api.abuse.ch",
          "kind": "external-domain",
          "nodeType": "domain"
        }
      ],
      "edges": [
        {
          "from": "Alert Triage Agent",
          "to": "Anthropic Chat Model",
          "kind": "model",
          "risk": false,
          "findings": []
        },
        {
          "from": "Alert Triage Agent",
          "to": "Send a message",
          "kind": "flow",
          "risk": true,
          "findings": [
            "TG-100-01",
            "AA-004-03"
          ]
        },
        {
          "from": "Alert Triage Agent",
          "to": "Scanner MCP",
          "kind": "tool",
          "risk": false,
          "findings": []
        },
        {
          "from": "Alert Triage Agent",
          "to": "ThreatFox IOC Lookup",
          "kind": "tool",
          "risk": false,
          "findings": []
        },
        {
          "from": "Alert Triage Agent",
          "to": "OTX IOC Lookup",
          "kind": "tool",
          "risk": false,
          "findings": []
        },
        {
          "from": "Webhook",
          "to": "Alert Triage Agent",
          "kind": "flow",
          "risk": true,
          "findings": [
            "TG-100-01",
            "AA-003-02"
          ]
        },
        {
          "from": "Anthropic Chat Model",
          "to": "credential:anthropicapi",
          "kind": "credential",
          "risk": false,
          "findings": []
        },
        {
          "from": "Scanner MCP",
          "to": "credential:httpbearerauth",
          "kind": "credential",
          "risk": false,
          "findings": []
        },
        {
          "from": "OTX IOC Lookup",
          "to": "credential:httpheaderauth",
          "kind": "credential",
          "risk": false,
          "findings": []
        },
        {
          "from": "ThreatFox IOC Lookup",
          "to": "credential:httpheaderauth",
          "kind": "credential",
          "risk": false,
          "findings": []
        },
        {
          "from": "Webhook",
          "to": "credential:httpheaderauth",
          "kind": "credential",
          "risk": false,
          "findings": []
        },
        {
          "from": "Send a message",
          "to": "credential:slackapi",
          "kind": "credential",
          "risk": false,
          "findings": []
        },
        {
          "from": "Scanner MCP",
          "to": "domain:mcp.your-env.scanner.dev",
          "kind": "outbound",
          "risk": false,
          "findings": []
        },
        {
          "from": "OTX IOC Lookup",
          "to": "domain:otx.alienvault.com",
          "kind": "outbound",
          "risk": false,
          "findings": []
        },
        {
          "from": "ThreatFox IOC Lookup",
          "to": "domain:threatfox-api.abuse.ch",
          "kind": "outbound",
          "risk": false,
          "findings": []
        }
      ]
    },
    "findings": [
      {
        "ruleId": "TG-100",
        "group": "critical-paths",
        "severity": "critical",
        "title": "A prompt-injection source can steer a privileged action through the AI agent",
        "description": "Content from an untrusted trigger reaches the model and the model can reach a privileged external action, with no validation or human approval anywhere on the path. A crafted input can therefore choose or influence the final action.",
        "affectedNodes": [
          "Alert Triage Agent",
          "Send a message",
          "Webhook"
        ],
        "evidence": {
          "path": [
            "Webhook",
            "Alert Triage Agent",
            "Send a message"
          ]
        },
        "remediation": "Break the chain: validate and constrain the input before the model, and require an explicit human approval step before the privileged action. Treat all trigger content as data, never as instructions.",
        "references": [
          "OWASP LLM01: Prompt Injection",
          "OWASP LLM06: Excessive Agency",
          "MITRE ATLAS AML.T0051: LLM Prompt Injection"
        ],
        "id": "TG-100-01"
      },
      {
        "ruleId": "AA-003",
        "group": "critical-paths",
        "severity": "high",
        "title": "Untrusted input can reach a model without a visible validation boundary",
        "description": "Untrusted input reaches a model node with no visible validation boundary on the path.",
        "affectedNodes": [
          "Alert Triage Agent",
          "Webhook"
        ],
        "evidence": {
          "detail": "Path: Webhook + Alert Triage Agent.",
          "path": [
            "Webhook",
            "Alert Triage Agent"
          ]
        },
        "remediation": "Add a deterministic validation step before the model. Enforce size, type and allowlist rules, separate instructions from data, and test direct and indirect prompt injection cases.",
        "references": [
          "OWASP LLM01: Prompt Injection"
        ],
        "id": "AA-003-02"
      },
      {
        "ruleId": "AA-004",
        "group": "approval-gaps",
        "severity": "high",
        "title": "A model can reach an external write action without an approval step",
        "description": "A model node can reach an external write action with no approval step on the path.",
        "affectedNodes": [
          "Alert Triage Agent",
          "Send a message"
        ],
        "evidence": {
          "detail": "Path: Alert Triage Agent + Send a message.",
          "path": [
            "Alert Triage Agent",
            "Send a message"
          ]
        },
        "remediation": "Require explicit human approval for messages, writes, deletions, purchases, account changes and other high-impact actions. Use least-privilege credentials for the final action.",
        "references": [
          "OWASP LLM06: Excessive Agency"
        ],
        "id": "AA-004-03"
      },
      {
        "ruleId": "AA-006",
        "group": "excessive-agency",
        "severity": "high",
        "title": "No rate or cost boundary was detected before model usage",
        "description": "No rate or cost boundary was detected between external input and model usage.",
        "affectedNodes": [
          "Webhook"
        ],
        "evidence": {
          "detail": "External inputs: Webhook."
        },
        "remediation": "Add per-user and per-origin limits, a maximum input size, a model-call budget, timeouts, and a bounded retry policy.",
        "references": [
          "OWASP LLM10: Unbounded Consumption"
        ],
        "id": "AA-006-04"
      },
      {
        "ruleId": "AA-005",
        "group": "excessive-agency",
        "severity": "medium",
        "title": "No structured model-output validation was detected",
        "description": "Model output is not validated against a structured schema before reuse.",
        "affectedNodes": [
          "Alert Triage Agent",
          "Anthropic Chat Model"
        ],
        "evidence": {
          "detail": "Model-related nodes: Anthropic Chat Model, Alert Triage Agent."
        },
        "remediation": "Validate model output against a strict schema before it is parsed, stored or passed to another tool. Reject unknown fields and unsafe values.",
        "references": [
          "OWASP LLM05: Improper Output Handling"
        ],
        "id": "AA-005-05"
      },
      {
        "ruleId": "AA-008",
        "group": "operational",
        "severity": "medium",
        "title": "Outbound requests do not show an explicit timeout or retry policy",
        "description": "Outbound HTTP nodes have no explicit timeout or retry policy.",
        "affectedNodes": [
          "OTX IOC Lookup",
          "ThreatFox IOC Lookup"
        ],
        "evidence": {
          "detail": "HTTP nodes: ThreatFox IOC Lookup, OTX IOC Lookup."
        },
        "remediation": "Set short timeouts and bounded retries with backoff. Make write actions idempotent so a retry cannot publish or charge twice.",
        "references": [
          "NIST AI RMF: Measure and Manage"
        ],
        "id": "AA-008-06"
      },
      {
        "ruleId": "AA-010",
        "group": "operational",
        "severity": "low",
        "title": "No workflow-level failure route was detected",
        "description": "The workflow has no error workflow or explicit failure route.",
        "affectedNodes": [],
        "evidence": {
          "detail": "The export has no errorWorkflow setting or explicit error node."
        },
        "remediation": "Add a failure route that records the error, alerts the operator and prevents partial actions from being treated as success.",
        "references": [
          "NIST AI RMF: Manage"
        ],
        "id": "AA-010-07"
      }
    ],
    "openFindings": [
      {
        "ruleId": "TG-100",
        "group": "critical-paths",
        "severity": "critical",
        "title": "A prompt-injection source can steer a privileged action through the AI agent",
        "description": "Content from an untrusted trigger reaches the model and the model can reach a privileged external action, with no validation or human approval anywhere on the path. A crafted input can therefore choose or influence the final action.",
        "affectedNodes": [
          "Alert Triage Agent",
          "Send a message",
          "Webhook"
        ],
        "evidence": {
          "path": [
            "Webhook",
            "Alert Triage Agent",
            "Send a message"
          ]
        },
        "remediation": "Break the chain: validate and constrain the input before the model, and require an explicit human approval step before the privileged action. Treat all trigger content as data, never as instructions.",
        "references": [
          "OWASP LLM01: Prompt Injection",
          "OWASP LLM06: Excessive Agency",
          "MITRE ATLAS AML.T0051: LLM Prompt Injection"
        ],
        "id": "TG-100-01"
      },
      {
        "ruleId": "AA-003",
        "group": "critical-paths",
        "severity": "high",
        "title": "Untrusted input can reach a model without a visible validation boundary",
        "description": "Untrusted input reaches a model node with no visible validation boundary on the path.",
        "affectedNodes": [
          "Alert Triage Agent",
          "Webhook"
        ],
        "evidence": {
          "detail": "Path: Webhook + Alert Triage Agent.",
          "path": [
            "Webhook",
            "Alert Triage Agent"
          ]
        },
        "remediation": "Add a deterministic validation step before the model. Enforce size, type and allowlist rules, separate instructions from data, and test direct and indirect prompt injection cases.",
        "references": [
          "OWASP LLM01: Prompt Injection"
        ],
        "id": "AA-003-02"
      },
      {
        "ruleId": "AA-004",
        "group": "approval-gaps",
        "severity": "high",
        "title": "A model can reach an external write action without an approval step",
        "description": "A model node can reach an external write action with no approval step on the path.",
        "affectedNodes": [
          "Alert Triage Agent",
          "Send a message"
        ],
        "evidence": {
          "detail": "Path: Alert Triage Agent + Send a message.",
          "path": [
            "Alert Triage Agent",
            "Send a message"
          ]
        },
        "remediation": "Require explicit human approval for messages, writes, deletions, purchases, account changes and other high-impact actions. Use least-privilege credentials for the final action.",
        "references": [
          "OWASP LLM06: Excessive Agency"
        ],
        "id": "AA-004-03"
      },
      {
        "ruleId": "AA-006",
        "group": "excessive-agency",
        "severity": "high",
        "title": "No rate or cost boundary was detected before model usage",
        "description": "No rate or cost boundary was detected between external input and model usage.",
        "affectedNodes": [
          "Webhook"
        ],
        "evidence": {
          "detail": "External inputs: Webhook."
        },
        "remediation": "Add per-user and per-origin limits, a maximum input size, a model-call budget, timeouts, and a bounded retry policy.",
        "references": [
          "OWASP LLM10: Unbounded Consumption"
        ],
        "id": "AA-006-04"
      },
      {
        "ruleId": "AA-005",
        "group": "excessive-agency",
        "severity": "medium",
        "title": "No structured model-output validation was detected",
        "description": "Model output is not validated against a structured schema before reuse.",
        "affectedNodes": [
          "Alert Triage Agent",
          "Anthropic Chat Model"
        ],
        "evidence": {
          "detail": "Model-related nodes: Anthropic Chat Model, Alert Triage Agent."
        },
        "remediation": "Validate model output against a strict schema before it is parsed, stored or passed to another tool. Reject unknown fields and unsafe values.",
        "references": [
          "OWASP LLM05: Improper Output Handling"
        ],
        "id": "AA-005-05"
      },
      {
        "ruleId": "AA-008",
        "group": "operational",
        "severity": "medium",
        "title": "Outbound requests do not show an explicit timeout or retry policy",
        "description": "Outbound HTTP nodes have no explicit timeout or retry policy.",
        "affectedNodes": [
          "OTX IOC Lookup",
          "ThreatFox IOC Lookup"
        ],
        "evidence": {
          "detail": "HTTP nodes: ThreatFox IOC Lookup, OTX IOC Lookup."
        },
        "remediation": "Set short timeouts and bounded retries with backoff. Make write actions idempotent so a retry cannot publish or charge twice.",
        "references": [
          "NIST AI RMF: Measure and Manage"
        ],
        "id": "AA-008-06"
      },
      {
        "ruleId": "AA-010",
        "group": "operational",
        "severity": "low",
        "title": "No workflow-level failure route was detected",
        "description": "The workflow has no error workflow or explicit failure route.",
        "affectedNodes": [],
        "evidence": {
          "detail": "The export has no errorWorkflow setting or explicit error node."
        },
        "remediation": "Add a failure route that records the error, alerts the operator and prevents partial actions from being treated as success.",
        "references": [
          "NIST AI RMF: Manage"
        ],
        "id": "AA-010-07"
      }
    ],
    "preExistingFindingIds": [
      "TG-100-01",
      "AA-003-02",
      "AA-004-03",
      "AA-006-04",
      "AA-005-05",
      "AA-008-06",
      "AA-010-07"
    ]
  },
  "limitations": [
    "This receipt compares exported JSON and a supplied staging record. It does not inspect production credential scope or external service authorization.",
    "Runtime evidence is accepted only when its canonical workflow fingerprint matches the candidate in this receipt.",
    "Local runtime receipts are reproducible evidence records, not cryptographically signed third-party attestations.",
    "A passing receipt records evidence for the tested policy and contract. It is not a penetration test, compliance certificate or security guarantee.",
    "Node names, node types, public domains and credential types can appear in the receipt. Prompt text, parameter values and credential values are omitted.",
    "Automatic findings remain review signals until a person records a manual review status. A score or clean static result is not a vulnerability verdict.",
    "Instance configuration, published-workflow identity, installed package versions and production permissions require separate environment evidence."
  ]
}